Netgear WG302v2 Command Injection Vulnerability in the ui_get_input_value Function

A command injection vulnerability has been identified in the Netgear WG302v2 access point, affecting versions through 5.2.9. The issue arises in the 'ui_get_input_value' function, where the 'host' argument is manipulated, allowing attackers to execute arbitrary commands on the system. This vulnerability can be exploited remotely, without authentication.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a crafted request that includes a malicious payload in the 'host' parameter. The payload will be executed as a system command, taking advantage of the lack of input validation in the 'ui_get_input_value' function.